Customers can get the following error when authenticating to Azure Active Directory with a federated account using MSAL (or now deprecated ADAL) Authentication library. { error: “invalid_request”, error_description: “AADSTS7500514: A supported type of SAML response was not found. The supported response types are ‘Response’ (in XML namespace ‘urn:oasis:names:tc:SAML:2.0:protocol’) or ‘Assertion’ (in XML namespace ‘urn:oasis:names:tc:SAML:2.0:assertion’). …. error_uri: “https://login.microsoftonline.com/error?code=7500514” } The error is typically seen in the following environment: A federated account…
Read MoreUsing PostMan to request an Azure AD token via SAML Assertion Grant flow
Azure Active Directory (Azure AD) supports an OAuth2 Extension Grant called “SAML Bearer Assertion flow” which allows an application to request an JWT OAuth2 token from Azure AD by providing a SAML Assertion (Token) acquired during an authentication process to a different Authorization Server. As you can imagine in order for this token exchange mechanism to happen, a trust relation between Azure AD and that Authorization Server must have already…
Read MoreHow to customize SAML token claims to include custom attribute created as Directory Schema Extension in Azure AD
Background Recently I was engaged to assist a customer with an interesting issue. This customer follows the guideline at https://docs.microsoft.com/en-us/previous-versions/azure/ad/graph/howto/azure-ad-graph-api-directory-schema-extensions to create a custom User attribute as a Directory schema extension and then assigns a value to the attribute. As an example, I have a few custom attributes created this way as can be seen by Microsoft Graph Explorer: The customer wants to have this custom attribute returned as a…
Read More